MiCA after July 2026: options for international crypto companies

This guide is for a business that provides crypto-asset services to users in the Union, or intends to, and now has to decide what it needs in order to keep doing so.

It is not for a firm whose assets are outside the framework altogether: assets that qualify as financial instruments, deposits or other instruments already regulated by Union financial services law fall outside it and are governed by those frameworks instead.2

It is not for a firm that already holds a Union authorisation as a credit institution, an investment firm or an electronic money institution and only wants to add specified crypto-asset services, because those entities may provide them on notification rather than through a separate authorisation.6

MiCA allowed providers that were operating under national law before 30 December 2024 to continue for a limited period, which ran until 1 July 2026 at the latest. Member States could shorten that period or decline to apply it at all, so it ended earlier in some of them.910

The practical consequence is that a national registration obtained before MiCA is no longer a basis for serving EU users, and acquiring a firm that holds one is no longer a route in.910

Which services the business actually provides, because the class of services sets the permanent minimum capital requirement that the own funds calculation starts from.8

Whether the business also issues a token, because offering an asset-referenced token to the public requires its own authorisation and an e-money token may be offered to the public only by an issuer authorised as a credit institution or as an electronic money institution.34

Whether the entity that will hold the authorisation is a legal person or other undertaking with a registered office in a Member State, with its place of effective management in the Union.15

Whether anything in the group already holds a Union authorisation that opens the notification route instead.6

Whether the firm is already a listed financial entity in another capacity, because operational resilience obligations attach to what a firm already is rather than to what it has applied for.11

The applicant must be a legal person or other undertaking with a registered office in a Member State, with its place of effective management in the Union.15

Own funds must be at least the higher of the permanent minimum capital requirement for the class of services provided and one quarter of the fixed overheads of the preceding year. The class minimum on its own is not the requirement.8

Some firms that already hold a Union authorisation, including credit institutions, investment firms and electronic money institutions, can provide specified crypto-asset services on notification instead.6

Offering an asset-referenced token to the public requires its own authorisation. An e-money token may be offered to the public only by an issuer authorised as a credit institution or as an electronic money institution.34

A crypto-asset service provider authorisation carries neither, so a firm that both operates a platform and issues a token is answering two questions, not one.34

Authorisation to provide the services. It is granted to an established entity, and the own funds it carries are the higher of the class minimum and one quarter of the fixed overheads of the preceding year.158

Issuance, which is not obtained through a service provider authorisation and follows its own route.34

Operational resilience. Authorised crypto-asset service providers and issuers of asset-referenced tokens are among the financial entities listed in DORA, which has applied since its date of application.1112

Then reach, which is a fourth question and not part of the first three: an authorised provider may serve users in other Member States after its competent authority has communicated the cross-border notification.7

Authorised crypto-asset service providers and issuers of asset-referenced tokens are among the financial entities listed in DORA, so ICT risk management binds them directly once they are authorised.1112

Applying does not by itself bring a firm inside DORA, so before authorisation the obligation comes from the sectoral application requirements. A firm that already holds another authorisation making it a listed financial entity is a different case: DORA already binds it in that capacity.1113

Shopping for a firm that still holds a registration from the old national rules. The route those registrations belonged to has closed, as the section above sets out with its sources, so what is being bought is the firm rather than the access.

Reading the class minimum as the capital requirement. The requirement stated above is the higher of two figures, one of which moves with the cost base, so a number fixed at the start of a plan is the wrong number by the time the plan is delivered.

Planning the platform and the token as one submission. They are two questions with two routes and two sets of evidence, and combining them tends to slow both.

Leaving operational resilience evidence until after authorisation, then finding that the group was inside those obligations all along in another capacity.

Write down the exact list of services the business provides to users in the Union, and beside each one the entity that will provide it and where that entity is established. That list, rather than a country shortlist, decides the size and the shape of everything that follows.